goTLS vs traefik.me
Both use the same magic-DNS trick — an IP embedded in the hostname — and both terminate TLS locally, so your traffic stays on your machine. The one real difference is what happens to the certificate's private key.
traefik.me provides a real, publicly-trusted wildcard certificate for *.traefik.me and publishes its private key for download, so your local proxy can complete the TLS handshake. That's the catch: anyone who has the key can impersonate or intercept any *.traefik.me host, so the "S" in HTTPS buys you no real confidentiality.
It also breaks the rules. Publishing a private key violates the CA/Browser Forum Baseline Requirements (a subscriber must keep the key confidential), so Let's Encrypt has revoked those certificates — as documented in this discussion. A published-key service is always one revocation away from breaking.
goTLS takes the Cloudflare "keyless SSL" approach instead: the private key never leaves goTLS's signer, which signs each individual TLS handshake on demand over a compact UDP protocol. There is no key to publish and nothing to revoke — yet the certificate is just as publicly trusted.
Side by side
| goTLS | traefik.me | |
|---|---|---|
| Magic wildcard DNS for any IP | Yes | Yes |
| Plain name resolves to localhost | Yes — any name with no IP → 127.0.0.1 | Yes |
| Traffic stays on your machine | Yes | Yes |
| Private key kept confidential | Yes — on the signer, never shared | No — published for download |
| Anyone with the key can MITM the cert | No | Yes — key is public |
| Can be revoked for publishing the key | No | Yes — has happened |
| Certificate model | publicly-trusted CA, signed per handshake by the keyless signer | publicly-trusted CA wildcard with a published key |
| Setup | run one proxy (docker run …) | load the published cert + key into your proxy |
Which should you use?
Pick traefik.me when
- You just want the DNS.
Pick goTLS when
- You actually require HTTPS
- Passkeys / WebAuthn, IoT / MQTTS, CI, or mobile devices are involved.
- You don't want a certificate that's one key-publication revocation away from breaking.
Credit where due: traefik.me pioneered valid HTTPS on magic-DNS hostnames and is dead simple. goTLS's tradeoff is that it needs its signer reachable over UDP to complete each handshake.
Try goTLS
Point the keyless proxy at your service and open the magic URL — no account, no key on your box.